Behavioral task
behavioral1
Sample
f8f5da7b96c618d92f51d9e384cb1f44ed6f4a9c464621cb6583b3c771c5f65f.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
f8f5da7b96c618d92f51d9e384cb1f44ed6f4a9c464621cb6583b3c771c5f65f.exe
Resource
win10v2004-20241007-en
General
-
Target
f8f5da7b96c618d92f51d9e384cb1f44ed6f4a9c464621cb6583b3c771c5f65f
-
Size
1.0MB
-
MD5
76950ee105d0ffb3cf5218a830b04939
-
SHA1
1ba2046fc71b4079ab0596ae269927dd8546fe1c
-
SHA256
f8f5da7b96c618d92f51d9e384cb1f44ed6f4a9c464621cb6583b3c771c5f65f
-
SHA512
cba23dd5ebb4698c85f5b08804ca21671e954bcc88d1ad1dc19e099f71f5afc6bd76cd1779b3b85828de46d25573ceee30bab947a52f706e98df18a7f4f7f722
-
SSDEEP
24576:a3cmZ57owRVVhWuVhdtPhAVK8yic4rkusyyeXGlA26QN:ecYVowRjhWewVUzYCIXG6Y
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/out.upx
Files
-
f8f5da7b96c618d92f51d9e384cb1f44ed6f4a9c464621cb6583b3c771c5f65f.exe windows:4 windows x86 arch:x86
Code Sign
0c:b5:11:e4:d2:b2:e7:7d:b9:39:3c:36:17:93:a0:8fCertificate
IssuerCN=xiedaxia,ST=江西,C=China,1.2.840.113549.1.9.1=#0c0d7869656461786961402e636f6dNot Before18/12/2022, 05:25Not After30/12/2099, 16:00SubjectCN=xiedaxia,ST=江西,C=China,1.2.840.113549.1.9.1=#0c0d7869656461786961402e636f6d0c:b5:11:e4:d2:b2:e7:7d:b9:39:3c:36:17:93:a0:8fCertificate
IssuerCN=xiedaxia,ST=江西,C=China,1.2.840.113549.1.9.1=#0c0d7869656461786961402e636f6dNot Before18/12/2022, 05:25Not After30/12/2099, 16:00SubjectCN=xiedaxia,ST=江西,C=China,1.2.840.113549.1.9.1=#0c0d7869656461786961402e636f6dfa:ae:66:cd:c0:5d:67:2b:18:5a:6a:94:90:4f:7e:de:67:9f:70:ca:3f:2d:e1:d9:5f:bb:28:82:7c:99:19:9fSigner
Actual PE Digestfa:ae:66:cd:c0:5d:67:2b:18:5a:6a:94:90:4f:7e:de:67:9f:70:ca:3f:2d:e1:d9:5f:bb:28:82:7c:99:19:9fDigest Algorithmsha256PE Digest Matchestruead:32:f8:05:2e:91:42:79:11:20:c3:b7:9e:96:82:fd:1c:7a:09:4fSigner
Actual PE Digestad:32:f8:05:2e:91:42:79:11:20:c3:b7:9e:96:82:fd:1c:7a:09:4fDigest Algorithmsha1PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 1022KB - Virtual size: 1024KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 22KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 712KB - Virtual size: 711KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 96KB - Virtual size: 323KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ